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Quantum cryptography has been recently ex- 
tended to continuous variable systems, e.g., the 
bosonic modes of the electromagnetic field. In 
particular, several cryptographic protocols have 
been proposed and experimentally implemented 
using bosonic modes with Gaussian statistics. 
Such protocols have shown the possibility of 
reaching very high secret key rates, even in the 
presence of strong losses in the quantum commu- 
nication channel. Despite this robustness to loss, 
their security can be affected by more general at- 
tacks where extra Gaussian noise is introduced 
by the eavesdropper. In this general scenario we 
show a "hardware solution" for enhancing the 
security thresholds of these protocols. This is 
possible by extending them to a two-way quan- 
tum communication where subsequent uses of the 
quantum channel are suitably combined. In the 
resulting two-way schemes, one of the honest par- 
ties assists the secret encoding of the other with 
the chance of a non-trivial superadditive enhance- 
ment of the security thresholds. Such results en- 
able the extension of quantum cryptography to 
more complex quantum communications. 

In recent years, quantum information has entered the 
domain of continuous variable (CV) systems, i.e., quan- 
tum systems described by an infinite dimensional Hilbert 
space 1, 2]. So far, the most studied CV systems are the 
bosonic modes, such as the optical modes of the electro- 
magnetic field. In particular, the most important bosonic 
states are the ones with Gaussian statistics, thanks to 
their experimental accessibility and the relative simplic- 
ity of their mathematical description [3, 0] ■ Accordingly, 
quantum key distribution (QKD) has been extended to 
this new framework @, S 0,H i, M, El, El, E, Q E H 
13, [H [11,0, [21I I and Gaussian cryptographic protocols 
using coherent states have been shown to exploit fully the 
potentialities of quantum optics 13, l3| • These coherent- 
state protocols are robust with respect to the noise of the 
quantum channel, as long as such noise can be ascribed to 
pure losses [l2,ll6[- -^y contrast, their security is strongly 
affected when channel losses are used to introduce a ther- 
mal environment, which is assumed to be controlled by a 
malicious eavesdropper [l^ . In this Gaussian eaves- 
dropping scenario, we present a method to enhance the 



security thresholds of the basic coherent-state protocols. 
This is achieved by extending them to two-way quantum 
communication protocols, where one of the honest par- 
ties (Bob) uses its quantum resources to assist the secret 
encoding of the other party (Alice). In particular, the 
enhancement of security is proven to be effective since 
the security thresholds are superadditive with respect to 
the double use of the quantum channel. Such a result 
is achieved when the Gaussian attack corresponds to a 
memoryless Gaussian channel. More generally, we also 
consider Gaussian channels with memory, therefore cre- 
ating classical and/or quantum correlations between the 
paths of the two-way quantum communication. In or- 
der to overcome this kind of eavesdropping strategy, the 
two-way protocols must be modified into suitable hybrid 
protocols, which represent their safe formulation against 
every kind of collective Gaussian attack. 



ONE-WAY PROTOCOLS 

In basic coherent-state protocols [ill [l3l, Alice pre- 
pares a coherent state |a) whose amplitude a = {Qa + 
iPA)/2 is stochastically modulated by a pair of indepen- 
dent Gaussian variables {Qa,Pa}i with zero mean and 
variance V ^ I. This variance determines the portion of 
phase space which is available to Alice's classical encod- 
ing {Qa,Pa} and, therefore, quantifies the amount of 
energy which Alice can use in the process. This energy 
is usually assumed to be very large V ^ 1 (large mod- 
ulation limit) in order to reach the optimal and asymp- 
totic performances provided by the infinite dimensional 
Hilbert space. The modulated coherent state is then sent 
to Bob through a quantum channel, whose noise is as- 
sumed ascribable to the malicious action of a potential 
eavesdropper (Eve). In ahomodyne (Horn) protocol '111, 
Bob detects the state via a single quadrature measure- 
ment (i.e., by a homodyne detection). More exactly. Bob 
randomly measures the quadrature Q or P, getting a 
real outcome Xb = Qb (or Pb) which is correlated to 
the encoded signal Xa — Qa (or Pa). In a heterodyne 
{Het) protocol [l5|, Bob performs a joint measurement 
of Q and P (i.e., a heterodyne detection). In such a 
case. Bob decodes the -variable Xb — {Qb,Pb} cor- 
related to the total signal Xa — {Qa,Pa} encoded in 
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the amplitude a. In both cases, AUce and Bob finally 
possess two correlated variables Xa and Xb, character- 
ized by some mutual information I{Xa ■ X^)- In order 
to access this mutual information, either Bob estimates 
Alice's encoding Xa via a direct reconciliation (DR) or 
Alice estimates Bob's outcomes Xb via a reverse recon- 
ciliation (RR) [221 • However, in order to extract some 
shared secret information from I{Xa '■ Xb), the honest 
parties must estimate the noise of the channel by broad- 
casting and comparing part of their data. In this way, 
they are able to bound the information I{Xa ■ E) or 
I{Xb ■ E) which has been potentially stolen by Eve dur- 
ing the process. Then, the accessible secret information 
is simply given by R*' := I{Xa ■ Xb) — I{Xa : E) for 
DR and by := I{Xa : Xb) ~ I{Xb : E) for RR. Such 
secret information can be put in the form of a binary key 
by slicing the phase space and adopting the standard 
techniques of error correction and privacy amplification 
[2^. In particular, Alice and Bob can extract a secret key 
whenever the channel noise is less than certain security 
thresholds, which correspond to the boundary conditions 
R*- ^0 and R-* = 0. 
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FIG. 1: Coherent state protocols. Alice prepares a coherent 
state I a) that Bob detects via a homodyne or heterodyne 
detector. A Gaussian (entangling doner) attack by Eve is also 
shown. Note that preparing a coherent state (via modulating 
the vacuum) can be equivalently achieved by heterodyning 
one of the two modes of an EPR pair. 



In the CV framework, collective Gaussian attacks rep- 
resent the most powerful tool that today can be han- 
dled in the cryptoanalysis of Gaussian state protocols 
H, US m, m ■ In the most general definition of a collec- 
tive attack, all the quantum systems used by Alice and 
Bob in a single run of the protocol are made to interact 
with a fresh ancillary system prepared by Eve. Then, all 
the output ancillas, coming from a large number of such 
single-run interactions, are subject to a final coherent 
measurement that is furthermore optimized upon all of 
Alice and Bob's classical communications. In particular, 
the collective attack is Gaussian if the single-run interac- 
tions are Gaussian, i.e., corresponding to unitaries that 



preserve the Gaussian statistics of the states. Notice that 
for standard one-way QKD, a single run of the protocol 
corresponds to a single use of the channel. As a conse- 
quence, every collective Gaussian attack against one-way 
protocols results in a memoryless channel and, therefore, 
can be called a one-mode Gaussian attack. Since the 
quadratures encode independent variables {Qa, Pa}, the 
single-run Gaussian interactions do not need to mix the 
quadratures (2J, SHIii. As a consequence, the Gaus- 
sian interaction can be modelled by an entangling doner 
(see Fig.[T]) where a beam splitter (of transmission T) 
mixes each signal mode A with an ancillary mode E be- 
longing to an Einstein-Podolsky-Rosen (EPR) pair (see 
Appendix) . Such an EPR pair is characterized by a vari- 
ance W and correlates the two output ancillary modes 
E', E" to be detected in the final coherent measurement. 
Notice that, from the point of view of Alice and Bob, 
this EPR pair simply reduces to an environmental ther- 
mal state pe with thermal number ue = {W — l)/2. 
A one-mode Gaussian attack can be therefore described 
by two parameters: transmission T and variance W or, 
equivalently, by T and N := {W - 1)(1 - T)T-i, the lat- 
ter being the excess noise of the channel. This parameter 
quantifies the amount of extra noise which is not refer- 
able to losses, i.e., the effect of the thermal noise scaled 
by the transmission [13] ■ The security thresholds against 
these powerful attacks can be expressed in terms of toler- 
able excess noise {N*' , TV"*} versus the transmission T of 
the channel. For protocols Ham and Het, these thresh- 
olds are displayed in Fig.[2]for DR and Fig.[3]for RR, and 
they confirm the results previously found in Refs. 31, S^l 
(see Appendix). 
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FIG. 2: Security thresholds in direct reconciliation. The figure 
shows the tolerable excess noise A'^*' (in quantum shot-noise 
units) versus transmission T. Curves compare the various 
one-way and two-way protocols against one-mode Gaussian 
attacks {N,T} in the limit of large modulation (V^ -l-oo). 




FIG. 3: Security thresholds in reverse reconciliation. The 
figure shows the tolerable excess noise A'"* (in quantum shot- 
noise units) versus transmission T. Curves compare the in- 
dividual one-way and two-way protocols against one-mode 
Gaussian attacks {A'^, T} in the limit of large modulation 



FROM ONE-WAY TO TWO-WAY PROTOCOLS 

The above coherent state protocols have been sim- 
ply formulated in terms of prepare and measure (PM) 
schemes. Equivalently, they can be formulated as 
entanglement-based schemes, where Alice and Bob ex- 
tract a key from the correlated outcomes of the measure- 
ments made upon two entangled modes (see Fig. [T]) . In 
fact, heterodyning one of the two entangled modes of an 
EPR pair (with variance V) is equivalent to remotely 
preparing a coherent state \a) whose amplitude is ran- 
domly modulated by a Gaussian (with variance V — 1) 
[2^ . In this dual representation of the protocol, Al- 
ice owns a physical resource which can be equivalently 
seen as an amount of energy ~ V for modulation (in 
the PM representation) or as an amount of entanglement 
~ log2T^ to be distributed (in the entanglement-based 
representation). Because of this equivalence, the previ- 
ous entanglement is also called virtual In the above 
one-way protocols, all these physical resources are the 
monopoly of Alice and their sole purpose is the encod- 
ing of secret information. However, we can also consider 
a scenario where these resources are symmetrically dis- 
tributed between Alice and Bob, and part of them is 
used to assist the encoding. This is achieved by combin- 
ing Alice and Bob in a two-way quantum communication 
where Bob's physical resources, to be generally intended 
as entanglement resources, assist the secret encoding of 
Alice, which is realized by unitary random modulations 
(see Fig. HI). 
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FIG. 4: General structure of the one-way, two-way and hy- 
brid protocols, together with their possible collective attacks. 
Circles and squares represent the physical resources available 
in the process. In particular, circles represent entanglement 
(possibly virtual) while squares are unitary modulations. In 
the inset (a), the basic one-way scheme is depicted, where all 
the resources are owned by Alice. In the insets (b) and (c), 
the physical resources are instead distributed between Alice 
and Bob, where Bob uses them for assisting while Alice for 
encoding (two-way scheme) . Inset (d) shows the hybrid proto- 
col where one-way's (OFF) and two-way's (ON) are randomly 
switched. All the insets also display Eve's collective attacks. 
The inset (a) shows the collective attacks against one-way 
protocols {one-mode attacks). The insets (b) and (c) show 
instead the collective attacks against the two-way protocols. 
These are one-mode (or reducible two-mode) in the inset (b) 
while two-mode in the inset (c). Finally, inset (d) shows the 
effects of a two-mode attack on the hybrid protocol. 



Let us explicitly construct such a two-way quan- 
tum communication. In simple two-way generalizations, 
Hom? and Het^, of the previous one-way protocols, Horn 
and Het, Bob exploits an assisting EPR pair (with vari- 
ance V) of which he keeps one mode Bi while sending the 
other to Alice (see Fig. [5]). Then, Alice encodes her infor- 
mation via Gaussian modulation (with variance V — I) 
by adding a stochastic amplitude a — {Qa + iPA)/2 to 
the received mode. Such a mode is then sent back to 
Bob, where it is detected together with the unsent mode 
Bi. Depending on the protocol. Bob will perform dif- 
ferent detections on modes Bi and B2- In particular, for 
the Horn? protocol. Bob will detect the Q (or P) quadra- 
ture of such modes (homodyne detections), while, for the 
Het^ protocol, he will detect both Q and P (heterodyne 
detections). From the outcomes, Bob will finally con- 
struct an optimal estimator Xb of Alice's corresponding 
variable A^, equal to Qa (or Pa) for Hom^ and to the 
E^-vector {Qa.Pa} for Het^. 

Since Bob's decoding strategy consists in individual 
incoherent detections, these entanglement-assisted QKD 
schemes are actually equivalent to two-way schemes with- 
out entanglement, where Bob stochastically prepares a 
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FIG. 5: Two-way quantum communication scheme. Bob ex- 
ploits an EPR pair to assist Alice's encoding. He keeps one 
mode Bi while sending the other one Ci to Alice who, in turn, 
perfoms a stochastic phase-space displacement +a. The re- 
sulting mode A2 is then sent back to Bob. The final modes 
Bi and B2 are incoherently detected by means of two homo- 
dyne detectors {Hom? protocol) or two heterodyne detectors 
{Het^ protocol). The figure also displays a one-mode Gaus- 
sian attack, where the forward mode Ci (from Bob to Alice) 
and the backward one A2 (from Alice to Bob) are subject to 
the action of entangling doners. 



quantum state to be sequentially transmitted forward 
and backward in the channel. In fact, one can assume 
that Bob detects Bi at the beginning of the quantum 
communication, so that the travelling mode Ci is ran- 
domly prepared in a reference quantum state (which is 
squeezed for Hom^ and coherent for Het^). This refer- 
ence state reaches Alice where stores the encoding trans- 
formation and, then, is finally detected by the second de- 
coding measurement of Bob. Therefore, if we restrict Bob 
to incoherent detections (classical Bob), then the two- 
way schemes also possess a dual representation, where 
the assisting entanglement resource is actually virtual, 
i.e., can be replaced by an equivalent random modula- 
tion. In this dual (entanglement-free) representation, the 
advantage brought by the two-way quantum communica- 
tion can be understood in terms of an iterated use of the 
uncertainty principle, where Eve is forced to produce a 
double perturbation of the same quantum channel. For 
instance, let us consider the Het^ protocol in the absence 
of eavesdropping. By heterodyning mode Bi, Bob ran- 
domly prepares mode Ci in a reference coherent state \(3) 
containing a random modulation 7 known only to him. 
Then, Alice transforms this state into another coherent 
state \a + (3) which is sent back to Bob. By the subse- 
quent heterodyne detection. Bob is able to estimate the 
total amplitude a + (3 and, therefore, to infer the signal 
a from his knowledge of /3. If we now insert Eve in this 
scenario, we see that she must estimate both the refer- 
ence /? and the masked signal a -I- /3 in order to access the 



signal a. This implies attacking both the forward and 
the backward channel (see Fig. [5|) and, since the noise 
of the first attack will perturb the second attack, we ex- 
pect a non trivial security improvement in the process. 
Such an effect intuitively holds under the assumption of 
one-mode attacks (where the two paths are attacked in- 
coherently) and it is indeed confirmed by our analysis. 
Quantitatively, we have tested the security performances 
of the two-way protocols against the one-mode Gaussian 
attacks {TV, T} and the corresponding security thresh- 
olds N*-'-* = N*-'-*{T) are shown in Fig. [U and Fig. [3] 
(see Appendix). For the two-way protocols, such thresh- 
olds relate the tolerable excess noise to the transmission 
in each use of the channel and, therefore, they are di- 
rectly comparable with the thresholds of the correspond- 
ing one-way protocols. By comparing Hom^ with Horn 
and Het^ with Het, one sees that the security thresh- 
olds are improved almost everywhere (the only exception 
being Horn^ for T > Tc — 0.86 in DR). Such a superad- 
ditive behavior is the central result of this work. Roughly 
speaking, even if two communication lines (e.g., two op- 
tical fibers) are too noisy for one-way QKD, they can 
be combined to enable a two-way QKD, as long as the 
quantum channel is memory less. 

In order to deepen our analysis on superadditivity, we 
also tested the previous one-way and two-way protocols 
when a classical Bob is replaced by a quantum Bob. 
This means that Bob is no longer limited to incoher- 
ent detections but can access a quantum memory storing 
all the modes involved in the quantum communication. 
Then, Bob performs a final optimal coherent measure- 
ment on all these modes in order to retrieve Alice's infor- 
mation. Such a coherent measurement can be disjoint, 
i.e., designed to estimate a single quadrature for each en- 
coding, or joint, i.e., designed to estimate both quadra- 
tures. Correspondingly, the modified one-way and two- 
way protocols will be denoted by ®Hom, ®Het, ®Hom^ 
and ®Het^. Notice that these collective protocols may 
not admit an equivalent entanglement-free representa- 
tion (where Bob's entanglement is replaced by a random 
modulation) if Bob's coherent measurement cannot be re- 
duced to incoherent detection. The corresponding secu- 
rity thresholds are shown in Fig. [2] (only DR can be com- 
pared, see Appendix). It is evident that superadditivity 
holds almost everywhere also for these collective schemes, 
the only exception being ®Hom? above the same critical 
value Tc as before. We easily note that ®Hom coincides 
with Horn, while ®Hom?' coincides with Hovi? . Then, 
in the case of disjoint decoding, the optimal coherent 
measurement asymptotically coincides with a sequence of 
incoherent homodyne detections. As a consequence, the 
collective protocols {^Hom and ^Horn^) collapse to the 
corresponding individual protocols [Horn and Hom^), 
where there is no need for a quantum memory. In partic- 
ular, this proves that (E)Hom^ admits an entanglement- 
free representation where infinitely-squeezed states are 
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sent to Alice through the forward path, and are then ho- 
modyned at the output of the backward path. The usage 
of quantum memories does better in the case of joint de- 
coding, since ^Het and ^Het"^ have much better perfor- 
mances than the corresponding individual protocols Het 
and Het^. As a consequence, no simple entanglement- 
free representation is known for ®Het^ . 

HYBRID PROTOCOLS 

We remark that our previous quantitative cryptoanal- 
ysis concerns one-mode Gaussian attacks, which are the 
cryptographic analog of a memory less Gaussian channel. 
However, when a multi-way scheme is considered, a sin- 
gle run of the protocol no longer corresponds to a single 
use of the channel. As a consequence, the most general 
collective attack against a multi-way scheme, even if in- 
coherent between separate runs, may involve quantum 
correlations between different channels. In general, an 
arbitrary collective attack against a two-way scheme can 
be called a two-mode attack. This is the general scenario 
of Fig. lUc) where the action of this attack on a single 
round-trip of quantum communication is given by an ar- 
bitrary map £^ . On the one hand, such an attack is said 
to be reducible to a one-mode attack if the map can be 
symmetrically decomposed as f ^ — £ o£ (i.e., the attack 
can be described by the scenario of Fig. SJ^b)) On the 
other hand, the two-mode attack is called irreducible if 
£^ ^ £ o £ (i.e., the attack of Fig. IDJc) cannot be de- 
scribed by Fig. HKb)). The latter situation includes all 
attacks where some kind of correlation is exploited be- 
tween the two paths, either if this correlation is classical 
(so that £^ = £2o£i with £i £2) or truly quantum (so 
that £^ ^ £20 £1 for every £1 and £2)- 

In order to detect and handle an irreducible attack, 
the previous two-way protocols, Horn? and Het^, must 
be modified into hybrid forms that we denote by Hom}'^ 
and Het^'^. In this hybrid formulation, Alice randomly 
switches between a two-way scheme and the correspond- 
ing one-way scheme, where she simply detects the incom- 
ing mode and sends a new one back to Bob. We may de- 
scribe this process by saying that Alice randomly closes 
(ON) and opens (OFF) the quantum communication cir- 
cuit with Bob, the effective switching sequence being 
communicated at the end of the protocol (see Fig.[4l^d)). 
By publicizing part of the exchanged data, Alice and Bob 
can perform tomography of the quantum channels in both 
the ON and OFF configurations. In particular, they can 
reconstruct the channel £^ affecting the two-way trip and 
the channels £1 and £2 affecting the forward and back- 
ward paths (see Fig. IH^d)). Then, they can check the 
reducibility conditions £1 ~ £2 and £^ = £2 ° £a ° £1, 
where £a{p) — D{a)pD'^ {a) is Alice's pubhcized encod- 
ing map. If such conditions are satisfied then the two- 
mode attack is reducible, i.e., Alice and Bob have ex- 



cluded every kind of quantum and classical correlation 
between the two paths of the quantum communication 
(see Appendix for an explicit description). In such a 
case, the honest users can therefore exploit the superad- 
ditivity of the two-way quantum communication. If the 
previous reducibility conditions are not met, then the 
honest users can always exploit the instances of one-way 
quantum communication. Notice that the verification of 
the reducibility conditions is rather easy in the Gaussian 
case, where the channels can be completely reconstructed 
by analyzing the first and second statistical moments of 
the output states. Also notice that the reducibility con- 
ditions exclude every kind of quantum impersonation at- 
tack [3^, where Eve short-circuits the channels of the 
two-way quantum communication. 

In conclusion, the hybrid protocols constitute a safe 
implementation of two-way protocols, at least in the pres- 
ence of collective Gaussian attacks (one-mode or two- 
mode). In the hybrid formulation, Alice and Bob can 
in fact optimize their security on both one-way and two- 
way quantum communication. The ON-OFF manipula- 
tion of the quantum communication can be interpreted 
as if Alice had two orthogonal bases to choose from dur- 
ing the key distribution process. In the presence of this 
randomization. Eve is not able to optimize her Gaussian 
attack with respect to both kinds of quantum commu- 
nication and the trusted parties can always make the a 
posteriori optimal choice. As a natural development of 
these results, one can consider a situation where Bob also 
performs a random and independent ON-OFF manipu- 
lation of the quantum communication. Such a scheme 
naturally leads to instances of n-way quantum commu- 
nication (with n > 2) whose security properties would 
be interesting to inspect in future work. In general, our 
results pave the way for future investigations in the do- 
main of secure multiple quantum communications, where 
quantum communication circuits can in principle grow to 
higher and higher complexity. 
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APPENDIX 

In this technical section, we first review some basic in- 
formation about Gaussian states. Then, we exhibit the 
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general expressions for the secret-key rates (in both direct 
and reverse reconcihation) when the various protocols are 
subject to one-mode Gaussian attacks. In the following 
subsections, we explicitly compute these secret-key rates 
for all the one-way and two-way protocols. From these 
quantities we derive the security thresholds shown in the 
paper. Finally, in the last subsection, we give the ex- 
plicit description of a general two-mode attack and we 
analyze the conditions for its reducibility. This last anal- 
ysis shows the security of the hybrid protocols against 
collective Gaussian attacks. 

Basics of Gaussian states 



where Z := A(l,-1) and I A(l,l). In Eq. g]) the 
variance V fully characterizes the EPR source [30|. On 
the one hand, it quantifies the amount of entanglement 
which is distributed between Alice and Bob, providing a 
log-negativity (s^l equal to 

Ej^ = max |0, -i \og{2V^ - 1 - 2V\/V^ - 1)| 

\og2V + 0{V-^) forV^>l. (5) 

On the other hand, it quantifies the amount of energy 
which is distributed to the parties, since the reduced ther- 
mal states Pa ■= TrB(p) and ps ■— Tr^(p) have mean 
excitation numbers equal to {V — l)/2. 



A bosonic system of n modes can be described by a 
quadrature row- vector Y := (Qi, Pi, . . . , Q„, P„) satis- 
fying [Yi, Yjn] = 2inira (1 <l,m< 2n), where 

k=l ^ ' 

defines a symplectic form. A bosonic state p is called 
Gaussian if its statistics is Gaussian [3, such a 

case, the state p is fully characterized by its displacement 
(Y) — Tr(Y/9) and correlation matrix (CM) V, whose 
generic element is defined by Vim '■— ^i^m + K„iy;)/2 — 
{Yi)^Jm) with diagonal terms Vu = I^Y^) - (y,)^ V{Yi) 
express the variances of the quadratures. According to 
Williamson's theorem [3], every CM V can be put in 
diagonal form by means of a symplectic transformation, 
i.e., there exists a matrix S, satisfying S"^r2S = Jl, such 
that S"^VS = A(z/i, v\^ - ■ ■ , i^n, where A denotes a 
diagonal matrix. The set of real values i> := {vi, • • • , Vn} 
is called symplectic eigenspectrum of the CM and pro- 
vides compact ways to express fundamental properties 
of the corresponding Gaussian state. In particular, the 
Von Neumann entropy S{p) :— — Tr(plogp) of a Gaus- 
sian state p can be expressed in terms of the symplectic 
eigenvalues by the formula [s^ 

n 
k=l 

where 

g(^) :^£±ilog£±i_ -ilog-^ 
^ logf + 0(i^-i) for i/> 1 . (3) 

Here, the information unit is the bit if log = logj or the 
nat if log — In. 

An example of a Gaussian state is the two-mode 
squeezed vacuum state [30] (or EPR source) whose CM 
takes the form 

v.P«(v) = VI j' 



General expressions for the secret-key rates 

The various protocols differ for the number of paths 
(1 or 2) and the decoding method, which can be joint, 
disjoint, individual or collective. In particular, when de- 
coding is disjoint the relevant secret variable X is Q G M 
(or P e R, equivalently) . When decoding is joint, the 
relevant secret variable X is {Q,P} G R^. Under the 
assumption of one-mode Gaussian attacks, the individ- 
ual protocols {Hom, Het, Hom^ , Het^) have the follow- 
ing secret-key rates for DR (►) and RR (<^) [13, HI] 

R*- := I{Xa : Xg) - I{Xa : E) , (6) 

:= liXA : Xb) - I{Xb : E) . (7) 

In these formulae, I{Xa ■ Xb) ■= H{Xb)-H{Xb\Xa) is 
the classical mutual information between Alice and Bob's 
variables Xa and Xb, with H{Xb) = {l/2)\ogV{XB) 
and H{Xb\Xa) = [l/'2.)\ogV{XB\XA) being the total 
and conditional Shannon entropies [39| . The term 

I{Xk ■■ E) := H{E) - H{E\Xk) (8) 

is the Holevo information [40| between Eve {E) and 
the honest user K = A,B (i.e., Alice or Bob). Here, 
H{E) :— S{pe) is the Von Neumann entropy of Eve's 
state pe and H{E\Xk) is the Von Neumann entropy con- 
ditioned to the classical communication of Xk- For the 
collective protocols {®Ho'm,®Het,®Hom? ^^Het^) we 
have instead 

R*- := I{Xa : B) - I{Xa : E) , (9) 

and 

R^ := I{Xa ■■ B) - I{B : E) , (10) 

where I{Xa ■ B), I{Xa ■ E) are Holevo informations, 
and 

I{B : E) -.^ H{B) + H{E) - H{B,E) (11) 
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is the quantum mutual information between Bob and 
Eve. By setting i? = in the above Eqs. dH), ©, © 
and ([TO]) one finds the security thresholds for the corre- 
sponding protocols. Notice that the Holevo information 
of Eq. ^ provides an upper bound to Eve's accessible 
information. In the case of collective protocols, Alice 
and Bob are able to reach the Holevo bound I{Xa ■ B) 
only asymptotically. This is possible if Alice communi- 
cates to Bob the optimal collective measurement to be 
made compatible with the generated sequence of signal 
states and the detected noise in the channel. Such a 
measurement will be an asymptotic projection on the 
codewords of a random quantum code as foreseen by 
the Holevo-Schumacher- Westmoreland (HSW) theorem 



Bob) are given by 



4ll . l42l | . Though such a measurement is highly complex, 
it is in principle possible and the study of the collective 
DR secret-key rate of Eq. ^ does make sense (it is also 
connected to the notion of private classical capacity of 
Ref. [ist). On the other hand, the quantum mutual in- 
formation of Eq. (fTTj) provides a bound which is too large 
in general, preventing a comparison between the collec- 
tive protocols in RR. 



Secret-key rates of the one-way protocols 

In the one-way protocols, Alice encodes two inde- 
pendent Gaussian variables QatPa in the quadratures 
Qa, Pa of a signal mode A, i.e., Qa = Qa + Qa\Qa and 
Pa = Pa-\- Pa\Pa- Here, the quantum variables Qa, Pa 
have a global modulation V ^ given by the sum of the 
classical modulation V{Qa) — ^(^a) = V — 1 and the 
quantum shot-noise V{Qa\Qa) = V{Pa\Pa) — 1- On 
the other hand, Eve has an EPR source epr{W) which 
distributes entanglement between modes E and E" . The 
spy mode E is then mixed with the signal mode A via a 
beam splitter of transmission T, and the output modes, 
B and E' , are received by Eve and Bob, respectively (see 
Fig. [ij . Let us first consider the case of collective pro- 
tocols {(S)Hom,iS)Het), where Bob performs a coherent 
detection on all the collected modes B in order to decode 
Xa = Qa (for (E)Hom) or Xa = {Qa,Pa} (for ®Het). 
For an arbitrary triplet {V, T}, the quadratures of the 
output modes, B and have variances 

V{Qb) = V{Pb) = {1-T)W + TV -.^hv , (12) 
V{Qe') = V{Pe') = (1 - T)V + TW := ey , (13) 

and conditional variances 

ViQslQA) = V{Pb\Pa) = (l -T)W + T = bi , (14) 
ViQE' \Qa) = V{Pe' \Pa) = {l-T) + TW = ei . (15) 

Globally, the CMs of the output states pB (of Bob), 
Pe'E" ■= Pe (of Eve) and pe'E"b ■= Pee (of Eve and 



\B{V,V)^^{bvM) , 
A[ey,ey] i^Z\ 



Ye{V,V) 



and 



V - ( F 

^EB - I pT 



, F 



(16) 
(17) 

(18) 



where 

[T(iy2_^)]i/2 ^ ^ _ {W-V)[{1-T)TY'^ , (19) 

and 

e ■.= [{l-T){W^ ^1)]^/^ . (20) 

The CMs of Bob {B) and Eve {E), conditioned to Alice's 
variable Xa, are instead equal to 



V 



K\Qa 



Vk(1,V) , V^.|Q,,P, =Vk(1,1) , (21) 



where K = B,E. For T 7^ 0, 1 and V ^ 1, the symplectic 
spectra of all the previous CMs are given by: 





- {TV) , 


(22) 


^B\Qa - 




(23) 


^B\Qa,Pa " 


- {bi} , 


(24) 


T^E - 


{{l-T)V,W} , 


(25) 


^E\Qa - 


yei{\-T)V,^Wb^lei} , 


(26) 


^E\Qa,Pa " 


- {^1,1} , 


(27) 


l^BE - 


- {^,1,1} . 


(28) 



By using Eqs. ([2]) and (l3|), we then compute all the Von 
Neumann entropies to be used in the quantities I{Xa ■ 
B), I{Xa ■■ E) and I{B : E) of Eqs. dH) and After 
some algebra we get the following asymptotic rates for 
the one-way collective protocols 



i?" [®Het] = log ^ - g{W) , 



(29) 



Wbi 

ei 



-g{W) , (30) 



and 

R^[<»Het] ^ log ^ - 5(14^) - 5(61) , (31) 

while R'*[®Hom] —00, because of the too large bound 
provided by I{B : E) in this case. 

Let us now consider the individual one-way protocols 
{Horn, Het). Bob's output variable is Qb = Qb for 
Horn, and 

{Qb,Pb}^2-'^''{Qb + Qo,Pb-Po} (32) 
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for Het (with Qo,Po belonging to the vacuum). From 
Eqs. p2| and (fT4| . we can calculate the variances V{Xb) 
and V{XB\Xji) that provide the non-computed term 
I{Xa : Xb) in Eq. Then, we get the following 

asymptotic rates in DR 



R*' [Horn] = R*" [(^Hom] , 



(33) 



and 



R*^ [Het] = log ,^,Jf^,+,^^ + gih) - giW) . (34) 

In order to derive the RR rates from Eq. ([7]) we must 
evaluate 



I{Xb : E) ^ H{E) - H{E[Xb) , 



(35) 



where H{E[Xb) is computed from the spectrum i'b\Xb 
of the conditional CM V^;!^^^. In RR, Eve's quantum 
variables 



Ye := {Qe':Pe':Qe":Pe 



(36) 



must be conditioned to the Bob's classical variable Xb- 
This is equivalent to constructing, from Xb, the optimal 
linear estimators ^ of Ye, in such a way that the 
residual conditional variables 



4Xe 



(37) 



have minimal entropy H{E[Xb)- For the Horn protocol, 
Bob's variable Xb = Qb can be used to estimate the Q 
quadratures only. Then, let Bob estimate Ye by 

Yj,"^^^ ^{q'QB,0,q"QB,0) , (38) 

so that the conditional variables are given by 

Ye[Qb = {Qe' - q'QB,PE',QE" ~ q"QB,PE") ■ (39) 

For T 7^ 0, 1 and V ^ 1, the optimal estimators are given 

by 



(40) 



and q" = 0. The corresponding conditional spectrum 



'^E\Qn^WVW{l-T)/T,l} (41) 

minimizes H{E[Qb) and leads to the asymptotic rate 

R^ [Horn] = \ log - g{W) . (42) 

For the Het protocol, Bob's variable Xb = {Qb,Pb} 
enables him to estimate both the Q and P quadrature, 
by constructing the Yg-linear estimator 



Y, 



{Qb,Pb) 



E 



{q'QB,p'PB,q"QB,p"PB 



(43) 



For T 7^ 0, 1 and V ^ 1, the optimal choice corresponds 
to 



(44) 
(45) 



q' =p' = -V2il-T)/T , 
and q" = p" = 0, which gives 

^ElQu,Pu^{i^-T + bi)/T,l} , 

and leads to the asymptotic rate 
R^ [Het] = log + g {^^^) - g{W) . (46) 

Secret-key rates of the two-way protocols 

In the EPR formulation of the two-way protocols (see 
Fig. [5]), Bob assists the encoding via an EPR source 
'V epr(V) that distributes entanglement between mode 
Bi, which is kept, and mode C'l, which is sent in the 
channel and undergoes the action of an entangling doner 
{T,W) : Ci ^ Ai. On the perturbed mode Ai, Alice 
performs a Gaussian modulation by adding a stochastic 
amplitude a = (Qa + «^'a)/2 with V{Qa) = V{Pa) = V 
and {QaPa) = 0. The modulated mode A2 is then sent 
back through the channel, where it undergoes the ac- 
tion of a second entangling doner (T,W) : A2 B2, 
where the output mode B2 is finally received by Bob. 
Let us first consider the collective two-way protocols 
{®Honi? ,®Het^), where Bob performs an optimal co- 
herent measurement upon all the collected modes Bi , B2 
in order to decode Xa = Qa (for ®Ho-m?) or Xa = 
{Qa,Pa} (for ®Het^). For an arbitrary quadruplet 
{V, V, W,T}, the CMs of the output states PB1B2 ■= Pb 
(of Bob) and Pe[E'{E'^e'^ ■= Pe (of Eve) are given by 



Vb(VV)^( ^ T^W-^IZ 
^B(V,V) yT^yT^r^ ABiV,V) 



, (47) 



and 



yE{V,V) 



/ 




ipZ 








ipZ 


WI 


0'Z 







p'l 


0'Z 


AEiV,V) 


ipZ 


V 








ipZ 


WI 1 



(48) 



where 

^.B{V, V) := [T^V + (1 - T'^)W]1 + TA{V, V) , (49) 
and 

AE{y,v) :=7i+(i-r)A(t/,y) , 

with 



(50) 



and 



^' , 9' := -^/l^e , (51) 

■.= T{l-T)V +{l-TfW + TW . (52) 
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The CMs of Bob {B) and Eve {E), conditioned to Alice's 
variable Xa, are instead equal to 



V 



K\Q^ 



Vk(0, V) , Vk|q^,p^ = Vk(0, 0) , (53) 



for K = B,E. Let us consider identical resources be- 
tween Alice and Bob, i.e., V = V-1. Then, for T ^0,1 
and y » 1, all the symplectic spectra are given by: 





{flVj2V} , 


(54) 




^ {<^V,^-WT{1-T^)WV} , 


(55) 


^B\Qa,Pa " 


{il-T^)V,W} , 


(56) 


Ue - 


{hiV,h2V,W,W} , 


(57) 


^E\Qa ' 




■ (58) 


^E\Qa,Pa - 


-> {il-T^)V,W,lA} , 


(59) 



where /1/2 = T, hih2 = (1 - T)^ and 

:= [l + T^{T^ + T-2)]^/^ , u := [I + ST+TY^^ ■ (60) 

By means of Eqs. ([2]) and ([3]), we compute all the Von 
Neumann entropies to be used in Eq. ([9]) , and we get the 
asymptotic rates 



i?*" [(^Hom'^] = 5 log 7j 



(1-T)2 



giw) 



and 



(61) 



(62) 



Clearly these rates imply the same DR threshold N*' — 
N*'{T) for ®Hom? and (^Het^, as is shown in Fig. [2l 
The derivation of R*[®Het^] and R*[®Horn?] is here 
omitted because of the trivial negative divergence caused 
by I{B : E). 

Let us now consider the individual two-way protocols 
Horn? and Het^ in DR. For the Hom? protocol. Bob 
decodes Qa by constructing the output variable Qb 
Qb2 ~TQbi from the measurements of Qbi and Qb2- I^i 
fact, since Qbi ^ Qci (for V ^ 1) and 

QB,=VTQA + TQc,+VT^iVTQE,+QE,) , (63) 
we asymptotically have 

Qb VtQa + SQ , (64) 

with 

SQ := VT^{VtQe, +Qe,) ■ (65) 

From V{Qb) and V{Qb\Qa) we easily compute I{Qa ■ 
Qb) to be used in Eq. It is then easy to check that 
the asymptotic DR rate satisfies 



For the Het^ protocol. Bob measures 



q-^2-^/\QB,-Qo) , 

p+ = 2-^/^Pb, + Po) , 



from the first heterodyne on Bi, and 

Q-^2-^/^Qb,-Qo') : 
P+ = 2-^'\Pb,+Po') , 



(67) 



(68) 



from the second one upon B2. Then, Bob decodes 
{Qa, Pa} via the variables 



Qb Q- - Tq- 
Pb := P+ + Tp+ 



(69) 



SP 



(70) 
(71) 



In fact, for T 7^ 0, 1 and V ^ 1, we have 

Qb ^ VtJ^Qa + 6Q' , Pb ^ VtJ^Pa 
with 

6Q' ■.= 2-^'^{5Q + TQq~Qo') 
and 

5P ■.= 2-^'^[Vi^{VtPe,+Pe,) + tPo + Po'] . (72) 

From V{Xb) = V{Qb)V{Pb) and V{Xb\Xa) = 
V{Qb\Qa)V{Pb\Pa) we then compute I{Xa ■ Xb) and 
the consequent asymptotic DR rate 

R^ [Hef] = log e(i,T)[i+T'+a-T^)v^] ~9(W)- (73) 

Let us now consider Hom^ and Het^ in RR. In or- 
der to derive the corresponding rates from Eq. (O, we 
must again compute H{E\Xb) from the spectrum of the 
conditional CM V^;!^^, where Eve's quantum variables 



Ye {Qe[ , Pe', , Qb;' , Pe'^ , Qe', , Pe', , Qb^' , ^b^' ) (74) 

arc conditioned to Bob's output variable Xb- Of course, 
this is again equivalent to finding the optimal linear es- 
timators Y^^^'' of Ye- For the Horn? protocol where 
Xb = Qb, the linear estimators of Ye take the form 

yi'^"^ := {q[QB, 0, q'lQs^O, g^Qs, 0, g^'Qs, 0) . (75) 

For T 7^ 0, 1 and y ^ 1, the optimal ones are given 
by q[ - q'( - g^' - and q'^ = --^{l-T)/T- The 
corresponding conditional spectrum is given by 



^E\Qe 



{miV,m2^/V,W,l} , 



with 



R*- [iJom^] = R*- [®Hom^] . 



(66) 



mima = [r"^(l - Tf{l + T^)WY^^ 
This leads to the asymptotic rate 

i?^ [Hom^] = i log i^y^ - g{W) . 



(76) 
(77) 
(78) 
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For the Het^ protocol, where Xb = {Qb, Pb}, we have 



{Qb.Pb) 



Ye 

{q[QB,p[PB,qiQB,p'lPB,q2QB,P2PB,q2QB,P2PB) ■ 

(79) 

For T ^ 0, 1 and V ^ 1, the optimal estimators are given 
by 



'?2=P2 = -V2(i-T)/r 



(80) 



and 



q'i=p'i=qi=Pi=q2=P2=o ■ (81) 

The corresponding conditional spectrum is given by 
'^eiqb^Pb {ni,n2,«3, (1 - T^)V} , 

where 

[1 + r3 + (1 - r)(i + T^)w]w 



1 2 A T{l + T) 

This spectrum leads to the final asymptotic rate 

R'*\npf'^] - Inr 2T(1+T) 

n [nai. \ — log e{l-T)[l+T^+il~r^)W] 

3 

+ J29(n^)-29(W) . 



(82) 



(83) 



Structure of two-mode attacks 

Let us describe the effects of a general two-mode attack 
when Alice and Bob adopt the hybrid protocol. In the 
hybrid protocol, Bob sends a modulated pure state Yp) b^ 
which is coherent for _ffei^'^ and squeezed for Hovn}'^ . 
Then, Alice modulates this state by a in the ON config- 
uration, while she detects \^>)b and re-sends a new \^p') 
in the OFF configuration. In general, in a two-mode at- 
tack, Eve can use a countable set of ancillas which can 
always be partitioned in three blocks E = i?2} 
(see Fig. 15]). However, such an attack can always be 
reduced to the cascade form of Fig. [T] This is a triv- 
ial consequence of the logical structure of the protocol, 
where the backward path (labelled by 2) is always subse- 
quent to the forward path (labelled by 1) and, therefore, 
a first unitary interaction [/ can condition a second one 
but the contrary is not possible. In the first uni- 
tary [/, two blocks of ancillas E\ and F interact with 
the forward path (1). One output E\ is sent to the final 
coherent detection while the other one F is taken as in- 
put for the second unitary Y . Such a unitary makes the 
backward path (2) interact with F (coming from J7) and 
another block of fresh ancillas i?2- The corresponding 
outputs of F and E2 are then sent to the final coher- 
ent detection. Note that such a description contains all 



(ON) 



E, F 



^ ^ ^ 



c 



(OFF) 



y 1 y 

E, Ej F 
^ ^ ^ 



(1) 



y 'J y 



FIG. 6: General two-mode attack against a hybrid protocol 
(displayed in both the ON and OFF configuration). The two 
paths of the quantum communication interact with a supply 
of ancillas that can always be divided into three blocks E\ , E2 
and F. 



the possible quantum and/or classical correlations that 
Eve can create between the forward and backward paths 
(both Gaussian and non-Gaussian). 

In the OFF configuration, the first channel £1 : 
|^_g {ip\ PA is described by the Stinespring dilation 

^li\'P)B{'P\) ^^^E^F UBEiFi\v)B{'P\ 



<^\0)e, {0\<^\0)f{0\)uIe,i 



(84) 



while the second channel £2 ■ \v')a iv'l ~^ Pb can be 
expressed by the physical representation [i^ 



^2(1^% (^'D = Trs.F Vae^f (I^')a 



®PF ®\0)e, (0|) vIe^f 



(85) 



where 



Pf = Tr 



BEi 



Ube^f {W)b (vI 

®nF{^\)uiE,F 



(86) 
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or 



(ON) 



U 



(OFF) 



^1 F 
11 



(1) 



- V 

E, F 



FIG. 7: Cascade form of the two-mode attack. In the first 
unitary U, two blocks of ancillas Ei and F interact with the 
forward path (labelled by 1). One output Ei is sent to the 
final coherent detection while the other one F is taken as input 
for the second unitary V. Such a unitary makes the backward 
path (labelled by 2) interact with F (coming from U) and 
another block of fresh ancillas E2. The corresponding outputs 
of F and E2 are then sent to the final coherent detection. 



is the (generally mixed) state coming from the attack of 
the first channel. In the ON configuration, the global 
map £^ : \(p) g {^\ — > pb is equal to 



Tr. 



Vbe(|^)s(¥'I®|0)e(0|)1>1 



where |0)e (0| := |0)^^ (0| ® |0)^^ (0| ® |0)^ . 

VbE VBE2FDB{a)UBEiF ■ 



BE 



(87) 



and 



Notice that the Stinespring dilation of Eq. (j87p is unique 
up to a local unitary transformation Ue acting on the 
output ancilla modes. In our description of the attack 
(see Fig. [7]) such a local unitary is included in the opti- 
mization of the final coherent detection. 

From Eq. it is clear that Eve's attack is void of 

quantum correlations if 



UbEiF = UbEi Uf 



(90) 



In such a case in fact the two unitaries U and V are no 
longer coupled by the F ancillas. Let us assume one of 
the incoherence conditions of Eq. (|89p and ([50]) . Then, 
we can group the ancillas into two disjoint blocks Ei = 
{Ei,F} and E2 = {E2} if Eq. §^ holds, or Ei = {£'1} 
and E2 = {£'2,^} if Eq. ^ holds. In both cases the 
one-mode channels of Eqs. and are expressed 
by the Stinespring dilations 



£ii\^)s (^1) = TrE, \Ube, {\^)b {^\ ® |0)e, (0|) 



and 



£2(|^%(^'|)-TrE, VaeA\^')a{v'\ 



V 



AE-2 



(91) 



(92) 



while the two-mode channel £^ is expressed by Eq. ([57|) 
with 



(93) 

is equivalent to 



(94) 



Vbe ■= VBE2DB{a)UBEi 

Now, one can easily check that Eq. 
the decomposability condition 

S"^ = £2° £a° £1 



This can be easily verified by inserting Eqs. (|9ip and 
into the right hand side of Eq. ([M)) and resorting to the 
uniqueness property of the Stinespring dilation. 

Once the presence of quantum correlations between the 
paths has been excluded, every residual classical correla- 
tion can be excluded by symmetrizing the forward and 
backward channels, i.e., by setting £1 = £2, which is 
equivalent to relating the two unitaries U and y by a par- 
tial isometry. In conclusion, the verification of the condi- 
tion £^ = 5 o £q o 5 by Alice and Bob explicitly excludes 
every sort of quantum/classical correlation between the 
two paths of the quantum communication. Moreover, 
such a verification is relatively easy in case of Gaussian 
attacks, since the corresponding Gaussian channels can 
be completely reconstructed from the analysis of the first 
two statistical moments. 
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